Privacy by design, as defined in CIPM, focuses on proactively embedding privacy controls into systems, processes, and technologies from the outset. Options A, B, and C all demonstrate forward-looking integration of privacy considerations during planning, design, and deployment phases.
Conducting a root cause analysis after a privacy incident is a reactive activity and falls under incident response and program improvement, not privacy by design. While such analysis is critical for maturity and prevention of future incidents, it does not represent designing privacy into systems before issues arise. CIPM clearly distinguishes between preventive design measures and corrective response actions, placing root cause analysis firmly in the latter category.